Forensic Data Search Device Targeted Extraction
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current computer forensic investigation methods are inefficient and time-consuming due to a multi-stage process of data extraction and analysis, prone to human error, and require investigators to be trained to identify relevant data, which can be laborious and take days or weeks to complete.
Innovation Solution
A data search method and device that allows for rapid and secure data extraction by inputting pre-determined search terms, searching for target data across file names, hash values, and metadata, categorizing and ranking data, and displaying indicators for quick identification of priority data, enabling untrained users to analyze only suspicious data without altering the original data integrity.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Measurement precision
If all data is extracted and analyzed using traditional multi-stage forensic processes, then comprehensive analysis is achieved, but the process becomes extremely time-consuming and laborious, taking days or weeks to complete
Solution Approach 1:
The patent extracts only the relevant data needed for analysis by implementing targeted search functions that identify and extract specific files, strings, and metadata matching search criteria, rather than extracting all data. This selective extraction approach maintains comprehensive analysis of relevant information while dramatically reducing the time required by avoiding unnecessary data processing.
2Measurement precision
If traditional forensic tools are used to extract and analyze data, then thorough examination is possible, but the process requires investigators to be highly trained to identify relevant data among vast amounts of information
Solution Approach 1:
The patent performs preliminary actions by pre-configuring search terms, criteria, and analysis parameters before the actual forensic examination. The system pre-processes data according to predetermined criteria, automatically identifying and categorizing relevant information. This eliminates the need for investigators to manually sift through vast amounts of data and reduces training requirements, as the system handles the complex identification tasks automatically.
3Measurement precision
If investigators manually analyze extracted data to identify relevant information, then detailed examination is achieved, but human error increases and reliability decreases
Solution Approach 1:
The patent replaces the mechanical system of manual human analysis with an automated computer-based analysis system. The system uses algorithms and automated processes to examine extracted data, identify patterns, and determine relevance based on predefined criteria. This substitution eliminates human errors associated with manual analysis while maintaining detailed examination capabilities, thereby improving reliability without sacrificing thoroughness.
4Quantity of substance
If all data is extracted for later analysis, then complete forensic evidence is obtained, but the extraction and storage process becomes complex and resource-intensive
Solution Approach 1:
The patent segments the forensic analysis process into distinct phases: targeted extraction of specific data elements, automated analysis of extracted data, and selective reporting of relevant findings. The extraction process is segmented to focus only on data matching search criteria, rather than extracting all data. This segmentation reduces the volume of data requiring storage and processing while maintaining complete forensic evidence of relevant information, thereby simplifying the overall extraction and storage process.
Data Source
AI summary
A data search method for computer forensic investigation comprising: inputting at least one pre-determined search term; searching a computer or digital device that is powered on in a forensically sound state for data matching one or more of the pre-determined search terms to identify target data from any of file names; strings; hash values or hash functions; installed programs; MAC and IP addresses; and/or metadata; and categorising the target data according to a pre-determined list of categories, wherein the categories are different to the search term/s and; wherein the data search method simultaneously searches for target data and categories the target data.